Skip to content

Commit 041fc05

Browse files
h4x0rclaude
andcommitted
fix: resolve YARA compile errors for unreferenced strings
Fix three rules with unreferenced string variables that cause compilation failures on YARA 4.5.5+: - python_remote_exec: include $urllib in condition - python_download_execute: include $stat in condition - python_fileless_execution: include $urllib in condition Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent cbce622 commit 041fc05

1 file changed

Lines changed: 3 additions & 3 deletions

File tree

rules/core.yar

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -465,7 +465,7 @@ rule python_exec_remote {
465465
$requests = "requests" nocase
466466
$http = /https?:\/\//
467467
condition:
468-
$exec and ($urlopen or $requests) and $http
468+
$exec and ($urllib or $urlopen or $requests) and $http
469469
}
470470

471471
rule python_env_exfiltration {
@@ -512,7 +512,7 @@ rule python_download_execute {
512512
$popen = "subprocess.Popen"
513513
$http = /https?:\/\//
514514
condition:
515-
$urllib and $http and $chmod and ($system or $popen)
515+
$urllib and $http and ($chmod or $stat) and ($system or $popen)
516516
}
517517

518518
rule python_fileless_execution {
@@ -527,7 +527,7 @@ rule python_fileless_execution {
527527
$read = ".read()"
528528
$http = /https?:\/\//
529529
condition:
530-
$exec and $urlopen and $read and $http
530+
$exec and ($urllib or $urlopen) and $read and $http
531531
}
532532

533533
rule python_nohup_background {

0 commit comments

Comments
 (0)